What Is a MAC Address? A Guide to Network Hardware IDs

A MAC address is a unique hardware identifier assigned to every network interface controller. It lets devices recognize and deliver data to one another inside a single local network segment, such as your home Wi-Fi or an office Ethernet LAN.

What is a MAC address?

MAC stands for Media Access Control. The address is a 48-bit value, normally shown as six pairs of hexadecimal digits separated by colons or hyphens. An example looks like 00:1B:44:11:3A:B7. Manufacturers burn this identifier into the device's firmware during assembly, which is why you'll hear it called a burned-in address, physical address, or hardware address.

In formal terms, the IEEE administers the address space and assigns OUIs to hardware vendors. When you buy a network card, a laptop, or a smart thermostat, the manufacturer has already claimed a block of addresses and programmed one into the device. This ensures that, in theory, no two factory-assigned MACs in the world are identical.

The governing format is EUI-48, short for Extended Unique Identifier. The first three octets make up the Organizationally Unique Identifier, a prefix registered to the manufacturer by the IEEE. You can explore the full structure and special address types in Wikipedia's MAC address overview. The last three octets are assigned uniquely by that manufacturer. With 48 bits in play, the total space offers roughly 281 trillion possible addresses, so genuine collisions between factory assignments are practically nonexistent.

Not every MAC address you see is the factory original. A locally administered address overrides the burned-in value through software or operating system settings. You can identify one by examining the second hex digit from the left. If the universal slash local bit is set to one, the address has been changed locally rather than assigned globally. This bit is the same one that phone operating systems toggle when they randomize your MAC for privacy.

How does a MAC address work?

MAC addresses belong to the Data Link layer, Layer 2 of the OSI model. While an IP address worries about end-to-end routing across the internet, a MAC address handles the immediate hop between neighbors on the same wire or wireless channel. When your computer sends a frame to a network printer, the Ethernet or Wi-Fi header carries the printer's MAC address so the local switch or access point can push the frame out the right port.

Devices can't send frames by IP alone. They need a map between Layer 3 and Layer 2, and that's what ARP, the Address Resolution Protocol, provides. A host broadcasts an ARP request asking which device owns a particular IP address. The target replies with its MAC address, and the sender stores the pair in its local ARP cache. If the target isn't on the local segment, the frame is sent to the default gateway's MAC address instead, and the router handles the rest. Switches do similar bookkeeping, learning which MAC addresses live on which physical ports and forwarding frames only where they're needed.

The first octet carries two special flags in its least significant bits. The very last bit of that octet is the Individual slash Group bit. When it's zero, the frame is unicast, meant for one recipient. When it's one, the frame is multicast. The second-to-last bit is the Universal slash Local bit. A zero means the address is the factory-assigned global identifier. A one means it's locally administered. The all-ones address FF:FF:FF:FF:FF:FF is reserved for broadcast, reaching every device on the segment at once.

Although 48 bits is the standard, some environments use EUI-64, a 64-bit format. IPv6 interface identifiers often derive from a modified EUI-64 process in which a 48-bit MAC is split, the value FF:FE is inserted in the middle, and the U/L bit is flipped. This creates a larger address space without requiring new hardware numbering schemes.

MAC address vs. IP address

Both identifiers locate devices on a network, but they operate at different layers and scales. A MAC address is hardcoded into hardware and functions only on the local segment. An IP address is logical, can be reassigned by DHCP, and routers use it to move traffic across autonomous systems and continents.

Picture a MAC address as the apartment number inside a building. The IP address is the street address that gets the mail to the correct building. Every time a packet crosses a router, the router strips the old Layer 2 header and writes a new one with the next hop's MAC address. The IP header remains untouched until the final destination. This separation is why you can replace a router or change ISPs without reconfiguring every device's hardware identifier. The MAC stays with the machine, while the IP topology changes around it. If you want to understand the logical side of this journey, our article on what is an IP address covers it in depth.

How to find your MAC address

Operating systems expose the MAC address through command-line tools and graphical settings panels. The commands below show the fastest way to retrieve it on each major platform. On most systems you can also find the value through the network settings GUI, but the command line is often faster when you're troubleshooting remotely or working on a headless server.

On Windows, open Command Prompt or PowerShell and run:

ipconfig /all

Look for the "Physical Address" field under your active adapter. Typical output resembles this:

Ethernet adapter Ethernet:

   Connection-specific DNS Suffix  . : example.com
   Description . . . . . . . . . . . : Intel(R) Ethernet Controller
   Physical Address. . . . . . . . . : A4-B1-C1-D1-E1-F1
   DHCP Enabled. . . . . . . . . . . : Yes

On Linux systems, the ip command replaces the older ifconfig utility:

ip link show

You'll see a block similar to:

2: eth0:  mtu 1500 qdisc fq_codel state UP mode DEFAULT group default qlen 1000
    link/ether a4:b1:c1:d1:e1:f1 brd ff:ff:ff:ff:ff:ff

On macOS, use ifconfig against the active interface, usually en0 for Wi-Fi:

ifconfig en0

The line starting with ether holds your MAC address.

If your device uses MAC address randomization, the value shown in software may differ from the factory label printed on the hardware.

MAC address randomization and privacy

A static factory MAC address is a perfect tracking token. It doesn't change when you move between coffee shops, airports, or malls. Unlike cookies, which browsers can clear, a raw MAC address is tied to the radio chipset itself. Before randomization became standard, anyone with a Wi-Fi sniffer could passively collect these identifiers and build movement profiles without the device ever joining a network.

Android 10 and later assign a randomized MAC to each saved network profile. Android's official documentation on MAC randomization explains that this address is persistent by default, meaning the same network sees the same randomized value across reconnections, but it isn't your real hardware address. Starting with Android 12, certain open networks or app-driven connection suggestions can trigger non-persistent randomization that rotates on a timer or after DHCP lease expiry. Apple introduced a similar feature in iOS 14 and macOS 15 under the name Private Wi-Fi Address. In both ecosystems, the randomized address sets the locally administered bit so network administrators can distinguish it from a factory assignment.

This privacy improvement comes with side effects for legacy network controls. MAC filtering, static DHCP reservations, and some parental control systems rely on a fixed hardware identifier. When phones rotate their addresses, those systems break. Enterprises and home users alike have shifted toward alternatives like WPA-Enterprise with certificates, captive portals, or username-based authentication.

Why MAC addresses matter

Local networks simply couldn't function without MAC addresses. Switches depend on them to learn port mappings and avoid flooding every frame to every host. ARP depends on them to bind IP addresses to physical interfaces. Every Ethernet frame and Wi-Fi data unit carries a source and destination MAC in its header, making direct delivery possible.

For network troubleshooters, the MAC address is a diagnostic starting point. The OUI reveals the device manufacturer. Packet captures use MACs to follow a frame's path. Duplicate MACs, though rare, can cause hard-to-find intermittent connectivity issues. In larger environments, MAC addresses tie into DHCP lease tables, dynamic DNS updates, and asset inventory systems.

Grasping how MAC addressing works makes the rest of the networking stack clearer. Once you understand Layer 2 delivery, protocols like ARP, DHCP, and Traceroute fall into place because you can see exactly where local forwarding ends and routed forwarding begins. It also explains why you can't simply ping a MAC address across the internet. The address has no meaning outside its own broadcast domain, which is why Layer 3 protocols and global addressing schemes were developed in the first place.